What the NSA’s Distillation Advisory Actually Claims About Chinese AI Firms

Image: The alleged distillation funnel — from US frontier models to distilled rivals.

On September 8–9, the NSA, CISA, and FBI issued joint advisory CSA AA26-251A. It alleges six China-based AI companies — DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI — have conducted “industrial-scale” distillation of US frontier models since at least late 2024. It names Claude, GPT, Gemini, and Grok variants, and says billions of tokens moved through bulk premium subscriptions, proxies, and multiple API pathways.

This is a US government claim, not a court finding. China’s ministries called it groundless, and no court has ruled on it. That distinction matters: an intelligence assessment can be consequential without being a legal judgment.

Distillation, in Plain English

Imagine a large model as a teacher. A user sends the teacher many questions, collects its answers, and trains a smaller “student” model on those question-and-answer pairs. The student does not need the teacher’s internal weights; it learns patterns from the outputs. That is model distillation.

Distillation is a method, not a verdict about intent. The dispute is scale, access, and purpose: the advisory alleges billions of tokens moved through paid accounts, proxies, and API routes to reproduce US frontier capabilities.

Image: NSA headquarters — Photo: National Security Agency, public domain

What the Advisory Alleges

The advisory says the six firms targeted variants of Claude, GPT, Gemini, and Grok, and that the activity likely had Chinese government awareness — an assertion in the advisory, not a court finding. Days later, an Anthropic report supplied additional backdrop: 200 million exchanges across seven labs, including a People’s Liberation Army user routing surveillance footage through Claude.

That report explains the attention, but neither report makes the allegation a judicial conclusion. The record here is a US claim, a Chinese denial, and contested evidence.

Why the Recommended Defenses Matter

The agencies recommend detecting anomalous accounts and usage ratios, subtly altering outputs for suspected distillers — “poisoning” the distillation data — and sharing intelligence across providers. The first treats API behavior as a signal; the second makes answers a defensive surface; the third recognizes that activity can move between providers and pathways.

This pairs terms of service with account telemetry, response controls, and vendor cooperation. It also makes attribution harder: an anomalous ratio can justify review without proving who is behind an account.

Practical Take for Builders

For teams using frontier APIs, track account volume and usage ratios, flag bulk or proxy patterns, and preserve context to review alerts rather than turn them into accusations. Shared API fingerprints can strengthen signals across providers.

For BrainMap-style products, know which notes leave your system, which model receives them, and which provider controls apply. Protecting capability should not hide output changes; clear policy and review beat treating every heavy user as a distiller.

Sources: NSA, CISA and FBI, Forkast, Unite.AI.

What do you think? Where should providers draw the line between protecting model capability and quietly changing answers for suspected distillers?